September 2026 - Security-news

SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-141 Project: SAML SSO - Service Provider [1] Date: 2026-September-09 Security risk: *Critical* 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper access control Affected versions: <3.2.0 CVE IDs: CVE-2026-87943 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange_saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow unauthorized users to access functionality or modify configuration values that should only be available to privileged users. Solution: Install the latest version: * Upgrade to SAML SSO - Service Provider 3.2.0 [3]. Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Roushan Kumar Singh (roushan59227) [5] * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team * Swan Kalata (akalata) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/miniorange_saml [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_saml/releases/3.2.0 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/roushan59227 [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://www.drupal.org/u/akalata [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-140 Project: SafeDelete [1] Date: 2026-September-09 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <1.0.88 CVE IDs: CVE-2026-87942 Description: This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have permission to create content of a content type configured for the orphaned nodes report. Solution: Install the latest version: * If you use the Safe Delete module, upgrade to Safe Delete 1.0.88 [3]. Reported By: * Lee Rowlands (larowlan) [4] of the Drupal Security Team Fixed By: * Joseph Olstad (joseph.olstad) [5] * Lee Rowlands (larowlan) [6] of the Drupal Security Team * Scott Morrison (scottm316) [7] Coordinated By: * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Lee Rowlands (larowlan) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team * Swan Kalata (akalata) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/safedelete [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/safedelete/releases/1.0.88 [4] https://www.drupal.org/u/larowlan [5] https://www.drupal.org/u/josepholstad [6] https://www.drupal.org/u/larowlan [7] https://www.drupal.org/u/scottm316 [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/larowlan [11] https://www.drupal.org/u/xjm [12] https://www.drupal.org/u/akalata [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Patreon - Critical - Unsupported - SA-CONTRIB-2026-139
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-139 Project: Patreon [1] Date: 2026-September-09 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported CVE IDs: CVE-2026-87941 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] Coordinated By: * Bram Driesen (bramdriesen) [6] of the Drupal Security Team * cilefen (cilefen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team * Swan Kalata (akalata) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/patreon [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/bramdriesen [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://www.drupal.org/u/akalata [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-138 Project: Key auth [1] Date: 2026-September-09 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.2.4 CVE IDs: CVE-2026-87940 Description: This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled. Solution: Install the latest version: * If you use the Key Auth module, upgrade to Key auth 2.2.4 [3]. Reported By: * Utkarsh Choudhary (sisyphus_ut) [4] Fixed By: * Utkarsh Choudhary (sisyphus_ut) [5] * solideogloria [6] Coordinated By: * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team * Swan Kalata (akalata) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/key_auth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/key_auth/releases/2.2.4 [4] https://www.drupal.org/u/sisyphus_ut [5] https://www.drupal.org/u/sisyphus_ut [6] https://www.drupal.org/u/solideogloria [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://www.drupal.org/u/akalata [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-137 Project: Feed Block [1] Date: 2026-September-09 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <2.0.2 || >=3.0.0 <3.0.2 CVE IDs: CVE-2026-87939 Description: The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability. Solution: Install the latest version: * If you use the 3.x branch, upgrade to Feed Block 3.0.2 [3]. * If you use the 2.x branch, upgrade to Feed Block 2.0.2 [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Mark Fullmer (mark_fullmer) [7] * mmarler [8] Coordinated By: * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team * Swan Kalata (akalata) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/feed_block [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/feed_block/releases/3.0.2 [4] https://www.drupal.org/project/feed_block/releases/2.0.2 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mark_fullmer [8] https://www.drupal.org/u/mmarler [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://www.drupal.org/u/akalata [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-136 Project: CSP log [1] Date: 2026-September-09 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:Some/E:Theoretical/TD:All [2] Vulnerability: SQL Injection Affected versions: <1.0.2 CVE IDs: CVE-2026-87938 Description: The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers. The module did not sufficiently sanitize user-supplied values used in database queries, resulting in an SQL injection vulnerability. This vulnerability is mitigated by the fact that an attacker needs access to an account with the /Access CSP reports/ permission to exploit the SQL Injection. Solution: Install the latest version: * If you use the CSP Log module, upgrade to CSP Log 1.0.2 [3]. Reported By: * eduardo morales alberti [4] Fixed By: * Ivo Van Geertruyen (mr.baileys) [5] of the Drupal Security Team Coordinated By: * Bram Driesen (bramdriesen) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team * Swan Kalata (akalata) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/csp_log [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/csp_log/releases/1.0.2 [4] https://www.drupal.org/u/eduardo-morales-alberti [5] https://www.drupal.org/u/mrbaileys [6] https://www.drupal.org/u/bramdriesen [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/xjm [9] https://www.drupal.org/u/akalata [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-135 Project: Central Authentication System (CAS) Server [1] Date: 2026-September-09 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open redirect Affected versions: <2.0.4 || >=2.1.0 <2.1.3 CVE IDs: CVE-2026-87937 Description: This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during logout, leading to an open redirect. This vulnerability is mitigated by the fact that an attacker must convince a user to click a specially crafted link. The vulnerability cannot be exploited without user interaction and does not allow an attacker to directly compromise the CAS server or bypass authentication. Solution: Install the latest version of Central Authentication System (CAS) Server module: * If you use the 2.0.x branch, upgrade to CAS Server 2.0.4 [3]. * If you use the 2.1.x branch, upgrade to CAS Server 2.1.3 [4] Reported By: * Kalle Kipinä (kekkis) [5] Fixed By: * Ted Cooper (elc) [6] Coordinated By: * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team * Swan Kalata (akalata) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/cas_server [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cas_server/releases/2.0.4 [4] https://www.drupal.org/project/cas_server/releases/2.1.3 [5] https://www.drupal.org/u/kekkis [6] https://www.drupal.org/u/elc [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://www.drupal.org/u/akalata [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
by security-news＠drupal.org 09 Sep '26

09 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-134 Project: amazee.ai Private AI Provider [1] Date: 2026-September-09 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:None/CI:All/II:Some/E:Theoretical/TD:Default [2] Vulnerability: SQL injection Affected versions: <1.3.7 || >=1.4.0 <1.4.3 CVE IDs: CVE-2026-87936 Description: This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize filter values before using them to build SQL queries in its Postgres/pgvector backend, allowing SQL injection. This vulnerability is mitigated by the fact that a site must be using the module's Postgres/pgvector vector database backend for a Search API AI Search index, and must expose one of that index's non-string fields as a filter (for example, through a View) that is reachable by the attacker. Solution: Install the latest version: * If you use the amazee.ai AI Provider [3] module for Drupal 1.4.x, upgrade to ai_provider_amazeeio 1.4.3 [4]. * If you use the 1.3.x branch, upgrade to ai_provider_amazeeio 1.3.7 [5]. Reported By: * Matan Kotick (matank001) [6] Fixed By: * Dan Lemon (dan2k3k4) [7] * Dimitris Spachos (dspachos) [8] Coordinated By: * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/ai_provider_amazeeio [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_provider_amazeeio [4] https://www.drupal.org/project/ai_provider_amazeeio/releases/1.4.3 [5] https://www.drupal.org/project/ai_provider_amazeeio/releases/1.3.7 [6] https://www.drupal.org/u/matank001 [7] https://www.drupal.org/u/dan2k3k4 [8] https://www.drupal.org/u/dspachos [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-129 Project: Media Library Importer [1] Date: 2026-September-02 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.6 CVE IDs: CVE-2026-81163 Description: A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media entity. Files that were deliberately kept outside the webroot, such as a private file store, become downloadable by anonymous visitors at a predictable URL. Solution: Install the latest version: * If you use the Media Library Importer module for Drupal upgrade to Media Library Importer 2.1.6 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Italo Mairo (itamair) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/media_library_importer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/media_library_importer/releases/2.1.6 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/itamair [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
by security-news＠drupal.org 02 Sep '26

02 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-133 Project: Webform Submissions Delete [1] Date: 2026-September-02 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.2.0 CVE IDs: CVE-2026-84921 Description: This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue [3] may prevent exploitation in practice on Drupal 10+. Solution: Install the latest version: * If you use the Webform Submissions Delete module, upgrade to Webform Submissions Delete 8.x-1.2 [4] Reported By: * Bernhard Karimi (bernhardk_oww) [5] Fixed By: * solideogloria [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Damien McKenna (damienmckenna) [8] of the Drupal Security Team * Dan Smith (galooph) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Pierre Rudloff (prudloff) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/webform_submissions_delete [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform_submissions_delete/issues/3396717 [4] https://www.drupal.org/project/webform_submissions_delete/releases/8.x-1.2 [5] https://www.drupal.org/u/bernhardk_oww [6] https://www.drupal.org/u/solideogloria [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/damienmckenna [9] https://www.drupal.org/u/galooph [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/prudloff [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0